Windows 10 Enterprise LTSC – What’s new in Windows | Microsoft Learn – Was this information helpful?

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
LTSC cannot be upgraded via WSUS or any other Windows Update method. You must run an in-place upgrade to move from one version of LTSC to. Cumulative Update for Windows 10 Version for ARMbased Systems (KB), Windows 10 LTSB, Windows 10, Updates, 3/15/
 
 

 

Windows 10 1809 ltsc updates.Windows 10, version 1809 end of servicing

 

Find information on known issues for Windows 10, version and Windows Server Looking for a specific issue? Want the latest Windows release health updates? Follow WindowsUpdate on Twitter. Existing VMs with existing Network Adapters should not have issues connecting after installing KB , only new Network Adapters created after installation of KB are affected.

When experiencing this issue, you might receive one of the following errors:. Workaround: To mitigate this issue, open an elevated PowerShell window select the Start button then type powershell, right click or long press on it and select ” Run as Administrator ” on all SCVMM managed Hyper-V hosts and run the following commands:.

A script with this workaround for large scale deployments and a post-install script that can be integrated with patching tools are available in this KB article. You do not need to install any update or make any changes to other servers or client devices in your environment to resolve this issue.

Note The below updates are not available from Windows Update and will not install automatically. Note: You do not need to apply any previous update before installing these cumulative updates. If you have already installed updates released December 13, , you do not need to uninstall the affected updates before installing any later updates including the updates listed above. If you are unsure if you are using any affected apps, open any apps which use a database and then open Command Prompt select Start then type command prompt and select it and type the following command:.

Next steps: We are working on a resolution and will provide an update in an upcoming release. After installing KB or later updates, you might be unable to reconnect to Direct Access after temporarily losing network connectivity or transitioning between Wi-Fi networks or access points. Windows devices used at home by consumers or devices in organizations which are not using Direct Access to remotely access the organization’s network resources are not affected.

Workaround: You can mitigate this issue by restarting your Windows device. Resolution: This issue was resolved in KB Depending on the workload of your DCs and the amount of time since the last restart of the server, LSASS might continually increase memory usage with the up time of your server and the server might become unresponsive or automatically restart.

Note: The out-of-band updates for DCs released November 17, and November 18, might be affected by this issue. Workaround: To mitigate this issue, open Command Prompt as Administrator and use the following command to set the registry key KrbtgtFullPacSignature to 0 :.

Note: Once this known issue is resolved, you should set KrbtgtFullPacSignature to a higher setting depending on what your environment will allow.

It is recommended to enable Enforcement mode as soon as your environment is ready. Re-using the account was blocked by security policy. This issue originates with the October security updates KB which introduced some hardening changes enabled by default for domain join. Please see KB – Netjoin: Domain join hardening changes to understand the new designed behavior. Affected scenarios include some domain join or re-imaging operations where a computer account was created or pre-staged by a different identity than the identity used to join or re-join the computer to the domain.

Next steps: Please see KB to understand the designed behavior. We have added insights to this KB, and are evaluating whether optimizations can be made in a future Windows Update. This guidance will be updated once those changes have released. When attempting to install KB , it might fail to install, and you might receive an error 0xf Note: This issue only affects the Security update for Secure Boot DBX KB and does not affect the latest cumulative security updates, monthly rollups, or security only updates.

We’ve invested heavily in helping to protect against ransomware , and we continue that investment with updated behavior monitoring and always-on real-time protection. Endpoint detection and response is also enhanced. New detection capabilities include:. Custom detection. With custom detections, you can create custom queries to monitor events for any kind of behavior such as suspicious or emerging threats.

You can use advanced hunting through the creation of custom detection rules. Improvements on OS memory and kernel sensors to enable detection of attackers who are using in-memory and kernel-level attacks. Historical detection capability ensures new detection rules apply to up to six months of stored data to detect previous attacks that might not have been noticed. Threat response is improved when an attack is detected, enabling immediate action by security teams to contain a breach:. Other capabilities have been added to help you gain a holistic view on investigations include:.

Threat analytics – Threat Analytics is a set of interactive reports published by the Microsoft Defender for Endpoint research team as soon as emerging threats and outbreaks are identified. The reports help security operations teams assess the effect to their environment. They also provide recommended actions to contain, increase organizational resilience, and prevent specific threats. Query data using Advanced hunting in Microsoft Defender for Endpoint. Use Automated investigations to investigate and remediate threats.

Investigate a user account – Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. Alert process tree – Aggregates multiple detections and related events into a single view to reduce case resolution time. Check sensor health state – Check an endpoint’s ability to provide sensor data and communicate with the Microsoft Defender for Endpoint service and fix known issues.

Integration with Azure Defender – Microsoft Defender for Endpoint integrates with Azure Defender to provide a comprehensive server protection solution. With this integration, Azure Defender can use Defender for Endpoint to provide improved threat detection for Windows Servers.

Integration with Microsoft Cloud App Security – Microsoft Cloud App Security uses Microsoft Defender for Endpoint signals to allow direct visibility into cloud application usage including the use of unsupported cloud services shadow IT from all Defender for Endpoint monitored machines. You’ll be able to onboard Windows Server in the same method available for Windows 10 client machines.

Onboard previous versions of Windows – Onboard supported versions of Windows machines so that they can send sensor data to the Microsoft Defender for Endpoint sensor.

Enable conditional access to better protect users, devices, and data. If we detect that your device’s time isn’t properly synced with our time servers and the time-syncing service is disabled, we’ll provide the option for you to turn it back on. We’re continuing to work on how other security apps you’ve installed show up in the Windows Security app. There’s a new page called Security providers that you can find in the Settings section of the app. Select Manage providers to see a list of all the other security providers including antivirus, firewall, and web protection that are running on your device.

Here you can easily open the providers’ apps or get more information on how to resolve issues reported to you through Windows Security. This improvement also means you’ll see more links to other security apps within Windows Security. Also see New capabilities of Microsoft Defender for Endpoint further maximizing the effectiveness and robustness of endpoint security. Microsoft Intune helps you create and deploy your Windows Information Protection WIP policy, including letting you choose your allowed apps, your WIP-protection level, and how to find enterprise data on the network.

You can also now collect your audit event logs by using the Reporting configuration service provider CSP or the Windows Event Forwarding for Windows desktop domain-joined devices. This release enables support for WIP with Files on Demand, allows file encryption while the file is open in another app, and improves performance.

For more information, see OneDrive files on-demand for the enterprise. The minimum PIN length is being changed from 6 to 4, with a default of 6. For more information, see BitLocker Group Policy settings.

New features in Windows Hello enable a better device lock experience, using multifactor unlock with new location and user proximity signals. Using Bluetooth signals, you can configure your Windows 10 device to automatically lock when you walk away from it, or to prevent others from accessing the device when you aren’t present. New features in Windows Hello for Business include:. You can now reset a forgotten PIN without deleting company managed data or apps on devices managed by Microsoft Intune.

Account Protection will encourage password users to set up Windows Hello Face, Fingerprint or PIN for faster sign-in, and will notify Dynamic lock users if Dynamic lock has stopped working because their device Bluetooth is off.

You can set up Windows Hello from lock screen for Microsoft accounts. Previously, you had to navigate deep into Settings to find Windows Hello. It’s easier to set up Dynamic lock, and WD SC actionable alerts have been added when Dynamic lock stops working ex: device Bluetooth is off.

Windows Defender Credential Guard is a security service in Windows 10 built to protect Active Directory AD domain credentials so that they can’t be stolen or misused by malware on a user’s machine. It’s designed to protect against well-known threats such as Pass-the-Hash and credential harvesting. Windows Defender Credential Guard has always been an optional feature, but Windows 10 in S mode turns on this functionality by default when the machine has been Azure Active Directory-joined.

This feature provides an added level of security when connecting to domain resources not normally present on devices running Windows 10 in S mode. For more information, see Credential Guard Security Considerations. Microsoft has released new Windows security baselines for Windows Server and Windows A security baseline is a group of Microsoft-recommended configuration settings with an explanation of their security effect.

An issue, known as SMBLoris , which could result in denial of service, has been addressed. You can still get to the app in all the usual ways. The WSC service now requires antivirus products to run as a protected process to register.

Products that haven’t yet implemented this functionality won’t appear in the Windows Security Center user interface, and Microsoft Defender Antivirus will remain enabled side-by-side with these products.

You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you’ve enabled that option in Color Settings. This security policy setting determines whether the username is displayed during sign-in.

The setting only affects the Other user tile. You can quickly take action on threats from this screen:. The tool runs from a Windows Preinstallation Environment Windows PE command prompt, but can also run from the full Windows 10 operating system. The GPT partition format is newer and enables the use of larger and more disk partitions. It also provides added data reliability, supports other partition types, and enables faster boot and shutdown speeds.

For more information, see DISM operating system uninstall command-line options. You can now run your own custom actions or scripts in parallel with Windows Setup. Setup will also migrate your scripts to next feature release, so you only need to add them once.

For more information, see Run custom actions during feature update. It’s also now possible to run a script if the user rolls back their version of Windows using the PostRollback option.

Portions of the work done during the offline phases of a Windows update have been moved to the online phase. This change results in a significant reduction of offline time when installing updates. For more information, see We’re listening to you. SetupDiag is a new command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When it searches log files, SetupDiag uses a set of rules to match known issues.

In the current version of SetupDiag there are 53 rules contained in the rules. The rules. If you have shared devices deployed in your work place, Fast sign-in enables users to quickly sign in to a shared Windows 10 PC. We’re introducing “web sign-in,” a new way of signing into your Windows PC. Update Compliance helps you to keep Windows 10 devices in your organization secure and up-to-date.

Update Compliance is a solution built using OMS Log Analytics that provides information about installation status of monthly quality and feature updates.

Details are provided about the deployment progress of existing updates and the status of future updates. Information is also provided about devices that might need attention to resolve issues. New capabilities in Update Compliance let you monitor Windows Defender protection status, compare compliance with industry peers, and optimize bandwidth for deploying updates. For more information about accessibility, see Accessibility information for IT Professionals.

Also see the accessibility section in What’s new in the Windows 10 April Update. In the Feedback and Settings page under Privacy Settings, you can now delete the diagnostic data your device has sent to Microsoft.

You can also view this diagnostic data using the Diagnostic Data Viewer app. The new chromium-based Microsoft Edge has many improvements targeted to kiosks. You can download and install Microsoft Edge separately. For more information, see Download and deploy Microsoft Edge for business. If you wish to take advantage of Kiosk capabilities in Microsoft Edge , consider Kiosk mode with a semi-annual release channel.

The OS uninstall period is a length of time that users are given when they can optionally roll back a Windows 10 update.